Information Technology Security Manager

Accops; Pune District; On-site; INR 4,000,000 - 6,500,000; Full time

Job summary

Accops in Pune, India, seeks a senior security leader to own information security strategy, governance, and program delivery across IT operations, product security, data protection, and regulatory compliance.

You will guide a team, implement AI-driven security tooling, and establish risk-based roadmaps aligned with ISO/IEC 27001, SOC 2 Type II, and DPDP requirements.

Qualifications

• Extensive experience leading security strategy across IT and product areas.
• Strong background in IAM, MFA, SSO and zero-trust controls.
• Proven ability to implement AI-enabled security operations and governance.

Responsibilities

• Define and lead the organization’s security strategy and DPO program across multi-country operations.
• Build SOC, vulnerability management, and threat-informed defense capabilities.
• Drive secure SDLC, API security, cloud controls, and software supply chain security.
• Lead data protection, DPIAs, data retention, and cross-border transfer policies.
• Represent security in enterprise due-diligence with CISOs and customers.

Skills

Identity & access management

Zero-trust architecture

Cloud security

Security governance

AI/ML security

Threat modeling

Incident response

Tools

SIEM/SOAR

EDR

SBOM tools

GRC platforms

Job description

• Own and scale global IT operations — end-user computing, networks, cloud infrastructure, and office IT for a distributed workforce.
• Dogfood our own product stack (ZTNA, MFA, SSO, MDM, virtualization) as the foundation of internal IT architecture — serving as both a validation environment and a reference implementation for customers.
• Design secure, identity-driven enterprise architecture with conditional access, device posture enforcement, and zero-trust segmentation.
• Drive adoption of zero-trust and least-privilege models across all infrastructure layers.
• Ensure high availability, performance, and resilience of internal systems with defined SLA targets.
• Implement cloud security posture management (CSPM) and cloud workload protection (CWPP) across cloud environments.

2. Security Strategy & Operations

• Define and execute the organization’s information security strategy, aligned to business objectives and the evolving threat landscape.
• Build and lead capabilities across:
• Security operations center (SOC) — with AI-augmented monitoring, detection, and response.
• Vulnerability management and patching with defined SLA-driven remediation timelines.
• Identity and access governance across internal and product environments.
• Establish threat-informed defense models aligned to frameworks like MITRE ATT&CK.
• Deploy and evolve AI-native security tooling for automated threat detection, anomaly identification, and intelligent alerting to reduce analyst burden and improve response times.
• Own the security governance framework for AI/ML usage across the organization — both internal tools and product-embedded capabilities.
• Address AI-specific threat vectors including:
• LLM-assisted phishing and deepfake-based social engineering.
• Prompt injection, data exfiltration via AI tools, and model manipulation risks.
• Shadow AI usage and ungoverned adoption of generative AI by employees.
• Define acceptable use policies and technical controls for AI tools (e.g., data classification rules for LLM inputs, approved tool lists, access controls for model endpoints).
• Evaluate and integrate AI-driven capabilities into the security operations stack — automated triage, behavioral analytics, predictive threat intelligence.
• Stay current on regulatory developments related to AI governance and data protection (e.g., EU AI Act, emerging regional frameworks).

4. Product & Platform Security

• Partner with engineering to embed secure SDLC practices with security gates at each stage of the development lifecycle.
• Drive security architecture reviews across the product portfolio, with particular focus on:
• Authentication and authorization layers (MFA, SSO, biometric authentication).
• ZTNA and VPN / VDI / workspace access components.
• MDM and endpoint management services.
• Secure OS and USB-based deployment surfaces.
• API and cloud-native services.
• Implement and mature:
• SAST, DAST, SCA, and SBOM practices with automated integration into CI/CD pipelines.
• Threat modeling (STRIDE or equivalent) as a standard practice for new features and architecture changes.
• Own software supply chain security — dependency integrity, build pipeline security, and provenance verification.
• Act as the internal authority on customer-facing product security posture — particularly critical given that our products are themselves security tools evaluated by CISOs and security teams.

5. Data Protection, Privacy & Security (DPO)

• Serve as the organization’s Data Protection Officer (DPO), with accountability for data privacy compliance across all 12 operating countries.
• Define and enforce data classification, data loss prevention (DLP), and encryption strategies (at rest, in transit, and in use) — across products and internal systems.
• Partner with product and engineering to embed privacy‑by‑design principles, particularly for products handling customer identity and access data.
• Own data protection impact assessments (DPIAs) for new products, features, and data processing activities.
• Ensure alignment between data handling practices and regulatory requirements across all operating geographies (GDPR, India’s DPDP Act, and regional data protection laws).
• Own data retention, anonymization, and cross‑border data transfer policies — including standard contractual clauses (SCCs) and binding corporate rules where required.
• Act as the primary point of contact for data protection authorities across jurisdictions.
• Lead and maintain certifications such as ISO/IEC 27001, SOC 2 Type II, and regional regulatory requirements across operating geographies.
• Build audit‑ready evidence frameworks — automated where possible — to reduce certification overhead and audit preparation time.
• Manage:
• Risk assessments (enterprise + product) with quantified risk scoring.
• Third‑party and vendor risk programs with defined assessment cadence.
• Software supply chain risk as part of the broader vendor and dependency risk posture.
• Multi‑country regulatory interactions and customer security reviews.

7. Customer Trust & External Interface

• Represent the company in security due diligence discussions with enterprise customers (CISOs, CIOs, Risk leaders) — with the understanding that as a security vendor, our own posture is scrutinized to a higher standard.
• Own responses to:
• RFP/RFI security sections.
• Regulatory inquiries.
• Build a trust narrative that positions our internal security practices as proof of our product philosophy — we secure ourselves with the same tools we sell.
• Contribute to sales enablement by reducing security‑related friction in enterprise deal cycles across all 12 operating countries.
• Define and operationalize incident response and crisis management frameworks with clear escalation paths and communication protocols.
• Conduct regular:
• Tabletop exercises with cross‑functional participation.
• Red team / blue team simulations (including AI‑augmented adversary simulations).
• Ensure alignment between cyber resilience and business continuity / disaster recovery planning.
• Define and track incident response metrics — Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Mean Time to Recover.

9. Security Culture & Awareness

• Build and run a security awareness program for 300+ employees across multiple countries — including phishing simulations, role‑specific training, and onboarding security modules.
• Establish a developer security champions program to distribute security ownership across engineering teams — especially critical in a company whose products are security tools.
• Foster a culture where security is everyone’s responsibility, not a bottleneck or afterthought.

10. Team & Capability Building

• Inherit and lead an existing team of 10 — 6 in IT Operations and 4 in Security — and grow the function by approximately 20% over the next 12 months (to ~12 people).
• Assess current capabilities, identify gaps, and hire strategically to build depth across security engineering, GRC, product security, and data protection.
• Structure teams across:
• IT Operations
• Security Engineering & Operations
• GRC, Compliance & Data Protection
• Product Security
• Customer Trust & Assurance
• Establish 24x7 readiness where required for enterprise support, with clear on‑call structures and escalation protocols.

Experience:

• 12–15 years across IT, security, and infrastructure roles, with a progression from hands‑on technical work to building and leading teams.
• Experience as a Manager / Head of Security / IT / Security Architect in a product company (strong preference for security, identity, or infrastructure product companies) or technology‑led enterprise environment.
• Strong exposure to regulated industries (BFSI, healthcare, SaaS serving regulated clients).
• Track record of building security programs that directly enabled revenue (shortened deal cycles, won enterprise accounts, achieved certifications that unlocked market segments).
• Experience operating across multiple geographies and regulatory environments is strongly preferred.

Technical Depth

• Identity and access systems (SSO, MFA, IAM, SCIM, directory services, biometric authentication) ideally with experience in organizations that build these products.
• Virtualization and secure workspace technologies (VDI, virtual desktops, thin‑client architectures).
• Endpoint and mobile device security (MDM, device posture, zero‑trust network access).
• Cloud security CSPM, CWPP, IAM policies, network segmentation across AWS/Azure/GCP.
• AI/ML security governance frameworks, LLM risk management, AI‑augmented security operations.
• Software supply chain security SBOM management, dependency scanning, build integrity.
• Secure OS and hardware‑rooted security concepts (bootable secure environments, USB‑based OS deployment).
• Proficiency with modern security tooling (SIEM/SOAR platforms, EDR, vulnerability scanners, cloud‑native security tools).

Security & Risk

• Strong grounding in threat modeling, adversary simulation, vulnerability management with SLA‑driven remediation, and incident response and crisis management.
• Hands‑on understanding of adversary behavior, attack paths, and AI‑enhanced threat vectors.

Compliance, Governance & Data Protection

• Deep familiarity with ISO/IEC 27001, SOC 2 Type II.
• Data protection regulations across multiple jurisdictions (GDPR, India’s DPDP Act, regional equivalents).
• DPO responsibilities — data protection impact assessments, breach notification obligations, cross‑border transfer mechanisms (SCCs, adequacy decisions).
• Emerging AI governance frameworks (EU AI Act and equivalents).